registry / tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events / 20.6.1

tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events@20.6.1

event bus

AI Security Review

scanned 13d ago · by lpm-firewall-ai

Importing the package triggers a hidden remote payload loader. It fetches an executable blob, stores it in a temporary directory, and launches it detached.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Any Node.js require/import resolving index.js.

Impact

Arbitrary attacker-supplied native code executes with the importing process user's privileges.

Mechanism

Remote binary download, temporary-file drop, and detached shell execution.

Attack narrative

A consumer merely requiring the advertised event-bus package executes index.js, which silently loads _ext.js. That module selects a platform payload URL, retrieves a blob from rotating concealed hosts or DNS TXT records, writes it to a temporary path, makes it executable on Unix, and starts it detached via /bin/sh or cmd.exe. This is an unconsented remote-code-execution chain unrelated to the documented API.

Rationale

Source inspection confirms an import-time downloader and detached payload launcher, not just suspicious primitives. The absence of lifecycle hooks does not mitigate execution on normal import.

Evidence

package.jsonindex.js_ext.jslib/telemetry.jsREADME.md/tmp/.analytics_state/var/tmp/.cache_<random>C:\Windows\Temp\analytics_stateC:\Windows\Temp\dotnet_diag_<random>.exe

Network endpoints7

Package presents itself as a trivial event bus (index.js exports a small EventBus class) but its main entry unconditionally requires./_ext on load. _ext.js selects a platform-specific payload, downloads a binary from Cloudflare Workers hosts whose names are reassembled at runtime from split-string fragments (oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf100-416.workers.dev), with a DNS TXT fallback under tin.dl.well1.site, tina.dl.well1.site, ldr.dl.well1.site, and win.dl.well1.site that base64-decodes chunked TXT records into a binary. The downloaded bytes are written to /tmp or %TEMP% under masqueraded names (dotnet_diag_<rand>.exe,.cache_<rand>), chmod 0755 on Unix, and spawned detached via cmd.exe or /bin/sh. Host strings and DNS discovery domains are concatenated from fragmented arrays to evade static analysis, and a no-op _l() function is scattered around the network I/O. The package name mimics an internal Tinkoff typed-client naming convention, consistent with a dependency-confusion attack against a private scope.

tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events@20.6.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code